CVE-2026-65013
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Onlook up to version 0.2.32 contains a Broken Object Level Authorization (BOLA) vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values in tRPC API procedures. Attackers can read, modify, and delete other users' projects, members, and conversation history.
Risk Assessment
The organization is at risk of unauthorized access to other users' data, potentially leading to leakage of sensitive information, project manipulation, and data integrity breaches.
Recommendation
Immediately update Onlook to a version containing the fix (commit 423e2e9) or later, which introduces proper authorization validation for tRPC API procedures.
Related vulnerabilities
- CVE-2026-76133Critical
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
- CVE-2026-73819Critical
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
- CVE-2026-82970Critical
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.
- CVE-2026-59111Critical
An OS command injection vulnerability in the eObčanka-Identifikace application (DIA) on MacOS allows an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
- CVE-2026-82695Critical
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-82694Critical
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
- CVE-2026-82693Critical
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-82692Critical
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
- CVE-2026-82691Critical
A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2026-82690Critical
A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Original NVD description (English source)
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.